Splunk Search

How to normalize the dates and subtract them from each other to get elapsed time?

cotyp
Path Finder

Hello,

I am trying to normalize the dates on the below fields and subtract them from each other. How would I go about doing that? Is there a way that if there is no termination date, show something that says, Active and employed for X amount of time?

Thanks in advanced!
alt text

0 Karma

493669
Super Champion

Try like this:

|eval Terminates Date=if(isnull('Terminate Date'),strftime(now(),"%m/%d/%Y"),'Terminate Date') |eval Days=if(isnotnull('Terminate Date'),round((strptime('Terminate Date',"%m/%d/%Y"))-(strptime('Start Date',"%Y-%m-%d")))/86400,"Active and employeed for ".(round((strptime('Terminates Date',"%m/%d/%Y"))-(strptime('Start Date',"%Y-%m-%d")))/86400)." Days")
0 Karma

cotyp
Path Finder

nice! How would I make sure both the Terminate and Start date are shown in the same format? For instance XX-XX-XXXX?

0 Karma

493669
Super Champion

like this i.e. first converting time into epoch and then set format using strftime

...|eval Start Date=strftime(strptime('Start Date',"%Y-%m-%d"),"%m-%d-%Y"),
Terminate Date=strftime(strptime('Terminate Date',"%m/%d/%Y"),"%m-%d-%Y")
0 Karma

493669
Super Champion

please accept the answer if it resolves your query.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...